As 2025 progresses, Portuguese factories face an expensive and growing threat: the average cost of a cyberattack in the industry already exceeds 5 million dollars, while ransomware targeting OT environments increased by 46 % in a single quarter.
The good news is that there is a clear - and realistic - contingency plan to cut losses and get you back in control of your company. Shall we dissect this problem once and for all?
Why Industry is the #1 Target
Hackers love the explosive mix of IT (servers, PCs) and OT (machines, PLCs): Manufacturing was the most attacked sector for the fourth year running, according to various international reports.
This preference is growing for three reasons:
- IT/OT convergence without adequate segmentation;
- Specialized ransomware: attacks against OT rose 87 % in 2024;
- Complex supply chains that multiply weak points.
In other words: the combination of increasingly connected production systems, narrow profit margins (which make any stop extremely costly) and an interdependent supply chain makes the industry a favorite breeding ground for cybercriminals.
Faced with this scenario, understanding the real financial impact of an attack - and how it can spread throughout the entire operation - is the next logical step for any manager who wants to keep the plant running and the business under control.
How much does an industrial cyberattack cost?
Reducing the bill for an attack starts with decisions that pay for themselves. Teams with a tested response plan save an average of €2.22M per incident, and Zero Trust architectures cut another 20% off the total cost. Below are five simple actions that offer a significant kind of return:
- 5.56 million dollars - average cost of a breach in the international industrial sector
- 5.13 million dollars - average cost of a ransomware attack, not including the ransom
- 260,000 dollars/hour - impact of downtime on a production line
- +46 % - rise in industrial ransomware in just one quarter
- 10 trillion euros - projected annual economic cost in the EU
A two-day blockage can eat up entire annual margins - and leave suppliers and customers adrift. Remember that!
Impact on Results
Shall we look at practical examples?
In August 2023, Clorox was forced to shut down systems and process orders manually after a ransomware attack disrupted the entire logistics chain. In the following quarter's results, the company predicted a 23% to 28% drop in sales - around 356 million dollars - directly attributable to the incident. By May 2024 the extraordinary costs had already amounted to 57 million dollars, including consultancy, forensics and restocking.
In October 2023, Boeing received a ransom demand of 200 million dollars from the LockBit group, which published 43 GB of confidential data after the company refused to pay. The attack forced a temporary shutdown of the global parts and distribution portal, disrupting customers and suppliers throughout the aerospace chain.
But it's not just criminals who "go into our pockets".
Within the European regulatory framework, the NIS2 directive establishes fines of up to 10 million euros or 2% of worldwide turnover for essential entities and 7 million euros or 1.4% for important ones, whichever is higher. The standard also requires serious incidents to be notified within 24 hours and mitigation measures to be demonstrated, making prevention a strategic imperative.
The human link remains critical: almost a third (31%) of the breaches analyzed in the last decade involved the use of stolen credentials. In attacks on web applications, this vector appears in 88% of cases, which reinforces the importance of training teams and strengthening identity controls.
This evidence shows that the losses go far beyond possible bailouts: they affect sales, the supply chain and regulatory sanctions. Taking proactive measures now is the quickest way to prevent the next incident from becoming a brake on growth.
5 Strategies to Reduce Costs and Gain Security
After understanding the financial weight of cyberattacks, it's important to focus on practical solutions. There are measures that can be easily integrated into the industrial routine and protect operations and the bottom line at the same time. Below are five strategies designed to turn security into savings:
- Quarterly OT audits
Frameworks such as IEC 62443 expose vulnerabilities before the attacker does. Companies that use asset discovery reduce detection time by 108 days. - Zero Trust Segmentation
Separating IT/OT networks blocks 30% of exploited vectors by 2024. Be guided by NIST SP 800-207. - Immutable backups + monthly tests
Cut the financial impact of ransomware to less than 1 million dollars, according to IBM simulations. - Anti-phishing training on the shop floor
31% of attacks start with stolen credentials. Short, practical sessions reduce malicious clicks by 70%. - Continuity plan + cyber insurance
Organizations with tested runbooks have already saved up to 1.49 million dollars in post-incident expenses
When applied in layers, these initiatives drastically reduce the impact of any incident without halting production. You just have to choose where to start and move forward, step by step, to gain resilience to possible cyberattacks.
P.S.: the latest S21sec report shows that 33.9% of ransomware attacks in the 2nd quarter of 2024 targeted industry in Portugal. Companies that have shielded OT and trained teams have reduced downtime to less than 24 hours!
FAQ
1 - On average, how much does a cyber-attack on a Portuguese factory cost?
The figures are around 1 to 5 million euros, but can exceed 10 million euros in large operations, according to European studies.
2 - What differentiates IT security from OT?
IT protects data; OT protects physical processes. Both require dedicated but integrated policies.
3 - How does NIS2 affect my business?
Essential companies will have 24 hours to notify critical incidents and risk fines of up to €10 M or 2% of turnover
Conclusion
The figures are clear: not acting is expensive, but the right choices put the entrepreneur back behind the wheel. How much is it worth to have production up and running tomorrow?
Next step: book your risk audit with Morebiz and find out which of these 5 pillars will generate the greatest immediate return for your business!
